AIP TALK 第三方 SSO / 嵌入集成指南

{
  "multi_user_mode": true,
  "auth_secret": "your-strong-random-secret",
  "sso_trusted_issuers": [
    {
      "issuer_id": "partner_erp",
      "secret": "issuer-shared-secret-only-you-and-cowagent-know",
      "audience": "http://localhost:9899",
      "tenant_mapping": {},
      "default_role_ids": ["tenant:user"],
      "auto_create_tenant": true,
      "auto_create_user": true,
      "sync_attributes": true,
      "assertion_ttl_seconds": 60,
      "ip_allowlist": ["10.0.0.0/8"],
      "enabled": true,
      "default_return_to": "/chat#view=aip-talk",
      "embed_return_to": "/embed/aip-talk",
      "allowed_origins": ["https://partner.example.com"],
      "embed_title": "AIP TALK",
      "embed_subtitle": "AI-Powered Automation for Every Decision",
      "welcome_greeting": "我是企业AI大脑，请提问"
    }
  ]
}

embed_title / embed_subtitle / welcome_greeting 为可选项， 分别控制嵌入页头部两行标题与欢迎屏初始提示语；不配置时使用上方缺省值。

import base64
import hashlib
import hmac
import json
import time
import uuid

ISSUER_SECRET = "issuer-shared-secret-only-you-and-cowagent-know"
AUDIENCE = "http://localhost:9899"

def b64url(data: bytes) -> str:
    return base64.urlsafe_b64encode(data).decode().rstrip("=")

def make_assertion(issuer_id: str, user_id: str, tenant_id: str) -> str:
    header = {"alg": "HS256", "typ": "JWT"}
    now = int(time.time())
    payload = {
        "iss": issuer_id,
        "sub": user_id,
        "tid": tenant_id,
        "name": "张三",
        "email": "zhangsan@example.com",
        "aud": AUDIENCE,
        "iat": now,
        "exp": now + 60,
        "jti": uuid.uuid4().hex,
        "roles": ["tenant:user"],
    }
    header_b64 = b64url(json.dumps(header, separators=(",", ":")).encode())
    payload_b64 = b64url(json.dumps(payload, separators=(",", ":")).encode())
    signing_input = f"{header_b64}.{payload_b64}".encode()
    signature = b64url(hmac.new(ISSUER_SECRET.encode(), signing_input, hashlib.sha256).digest())
    return f"{header_b64}.{payload_b64}.{signature}"

assertion = make_assertion("partner_erp", "user-001", "org-001")
print(assertion)

{
  "status": "success",
  "token": "cowagent-v2-token-string",
  "user_id": "ext:partner_erp:user-001",
  "tenant_id": "ext:partner_erp:org-001",
  "roles": ["tenant:user"],
  "expires_in": 2592000
}

<form id="sso-form" method="POST" action="http://localhost:9899/auth/sso">
  <input type="hidden" name="assertion" value="GENERATED_ASSERTION" />
  <input type="hidden" name="return_to" value="/embed/aip-talk" />
</form>
<script>document.getElementById("sso-form").submit();</script>

window.addEventListener("message", (event) => {
  if (event.origin !== "http://localhost:9899") return;
  if (event.data?.type === "cow:resize" && event.data.height) {
    document.getElementById("aip-talk-frame").style.height = event.data.height + "px";
  }
});

const iframe = document.getElementById("aip-talk-frame");
const allowedOrigin = "http://localhost:9899";

window.addEventListener("message", (event) => {
  if (event.origin !== allowedOrigin) return;

  if (event.data?.type === "cow:ready") {
    console.log("AIP TALK ready, version:", event.data.version);

    // 同步第三方系统的主题
    const theme = localStorage.getItem("theme") || "light";
    iframe.contentWindow.postMessage({ type: "cow:set-theme", theme }, allowedOrigin);

    // 同步语言
    iframe.contentWindow.postMessage({ type: "cow:set-lang", lang: "zh" }, allowedOrigin);
  }
});

// token 即将过期时刷新
function refreshToken(newToken) {
  iframe.contentWindow.postMessage({ type: "cow:refresh-token", token: newToken }, allowedOrigin);
}

curl -G http://localhost:9899/api/v1/insights/decisions \
  -H "Authorization: Bearer YOUR_TOKEN" \
  -d "session_id=session_xxx" \
  -d "status=reviewed" \
  -d "page=1" \
  -d "page_size=20"